[NO JIRA]: Fix RCE vulnerability in serialize-javascript (GHSA-5c6j-r48x-rmvq)#200
Open
Matthew Robertson (metalix2) wants to merge 4 commits intomainfrom
Open
[NO JIRA]: Fix RCE vulnerability in serialize-javascript (GHSA-5c6j-r48x-rmvq)#200Matthew Robertson (metalix2) wants to merge 4 commits intomainfrom
Matthew Robertson (metalix2) wants to merge 4 commits intomainfrom
Conversation
Add npm overrides to pin serialize-javascript@7.0.5 and bfj@7.0.2 to prevent resolution of versions with known vulnerabilities. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds npm-level dependency pinning to reduce exposure to known vulnerabilities by forcing specific transitive versions during installs of this repository.
Changes:
- Added npm
overridesto forceserialize-javascript@7.0.5 - Added npm
overridesto forcebfj@7.0.2
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Bump css-minimizer-webpack-plugin to ^8.0.0 (pulls serialize-javascript@^7.0.3) - Bump terser-webpack-plugin to ^5.5.0 (drops serialize-javascript dep entirely) - Bump workbox-webpack-plugin to ^7.4.1 (replaces deprecated rollup-plugin-terser) - Pin serialize-javascript and bfj via overrides in root package.json - Bump Node engine to >=20.9.0 (required by css-minimizer v8 and workbox v7) Consumers will now automatically get serialize-javascript@7.0.5 without needing to add their own overrides. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Pin bfj to exact 7.0.2 in react-scripts (prevents consumers resolving to 7.1.0 which introduces underscore vulnerability via jsonpath) - Remove bfj override from root (exact pin handles it) - Keep serialize-javascript override for docusaurus workspace deps Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Matthew Robertson (metalix2)
changed the title
serialize-javascript@7.0.5 uses crypto.getRandomValues() which requires Node 19+ as a global. Update all CI workflows from Node 18 to Node 20 to match the engine requirement. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patches two high severity vulnerabilities in transitive dependencies.
1. RCE in serialize-javascript (GHSA-5c6j-r48x-rmvq)
serialize-javascript(<= 7.0.2) is vulnerable to code injection viaRegExp.flagsandDate.prototype.toISOString()— an incomplete fix for CVE-2020-7660. If an attacker can control the input object passed toserialize(), they can inject malicious JavaScript that executes when the serialized string is later evaluated (viaeval,new Function, or<script>tags).2. DoS via unlimited recursion in underscore (GHSA-qpx9-hpmf-5gmw, CVE-2026-27601)
underscore(<= 1.13.7) has unlimited recursion in_.flattenand_.isEqual. Under specific conditions, an attacker could exploit this for Denial of Service by triggering a stack overflow via deeply nested data structures from untrusted input.bfjto exact7.0.2which does not depend onunderscore. Version 7.1.0+ introducesjsonpathwhich pulls in the vulnerableunderscore.Changes
css-minimizer-webpack-plugin^3.4.1 → ^8.0.0 (pullsserialize-javascript@^7.0.3)terser-webpack-plugin^5.2.5 → ^5.5.0 (dropsserialize-javascriptdep entirely)workbox-webpack-plugin^6.6.1 → ^7.4.1 (replaces deprecatedrollup-plugin-terser)bfjto exact7.0.2(prevents drift to 7.1.0 which introducesunderscorevulnerability viajsonpath)serialize-javascriptoverride in root for workspace deps (docusaurus)Consumer Impact
Consumers of
@skyscanner/backpack-react-scriptswill automatically get patched versions — no action needed on their part.Test plan
npm run buildpasses with new dependency versionsserialize-javascriptinstances resolve to 7.0.5underscorein dependency tree🤖 Generated with Claude Code